High severity7.5GHSA Advisory· Published Mar 20, 2025· Updated Apr 15, 2026
CVE-2024-12886
CVE-2024-12886
Description
An Out-Of-Memory (OOM) vulnerability exists in the ollama server version 0.3.14. This vulnerability can be triggered when a malicious API server responds with a gzip bomb HTTP response, leading to the ollama server crashing. The vulnerability is present in the makeRequestWithRetry and getAuthorizationToken functions, which use io.ReadAll to read the response body. This can result in excessive memory usage and a Denial of Service (DoS) condition.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/ollama/ollamaGo | <= 0.3.14 | — |
Affected products
3- ghsa-coords2 versions
<= 0.3.14+ 1 more
- (no CPE)range: <= 0.3.14
- (no CPE)range: < 0.0.20250331T171002-1.1
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.